IPMediumSignal 66/100

`205.210.31.45`

Location

United States

Santa Clara, California

ASN

AS396982

Palo Alto Networks, Inc

First Seen

Aug 20, 2022

Last Seen

Jun 17, 2026

Aug 20

First Seen

1408d ago

Jun 17

Last Seen

11d ago

Reports

source reports

66%

Confidence

medium

Found in 37 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.

IPv4 Address

Network layer indicator observed in threat reports.

MISP Category

Network Activity

Confidence

66%

Signal Score

66 / 100

IDS Rule

Threat Context

MITRE ATT&CK TTPs

118 techniques

Network Information

Country

United States

RegionSanta Clara, California

ASNAS396982

OrganizationPalo Alto Networks, Inc

IP Category

⟲

Proxy

Proxy server

Feed Intelligence Summary

37 reports66% confidence

Source reports

66%

Confidence score

Category tags

abuseaccessaccess controlaccount compromiseaccount securityackack scanactive scanactive scanningadbadb attacksadbhoney activityadbhoney attacksadbhoney honeypotadbhoney interactionsadministrative accessagentalertandroid device attacksandroid devicesapplication layer protocolapplication scanningaptasiaasset discoveryattackattack surface discoveryattack vector: networkattack vectorsattacker ipattacker-ipaustraliaauthenticationauthentication abuseauthentication attackauthentication attemptauthentication attemptsauthentication_bypassautomated attackautomated attacksautomated enumerationautomated reconnaissance activityautomated threatautomated-attackautomated_attackbad reputationbad web botblacklist candidateblacklist ipblacklisted ipblock listblocklist_allblog spambotnetbotnet activitybotnet-activitybrute forcebrute force attackbrute force attackerbrute force attacksbrute force attemptbrute force attemptsbrute-forcebrute-force attackbrute-force-attackbrute_forcebrute_force_attackbruteforcec2 communicationc2 servercanadachinachina mobilecins activecisco attackcisco devicecisco device attackcisco device attackscisco device scanningcisco device targetingcisco exploit attemptcisco exploitationcisco exploitation attemptcisco exploitation attemptscisco network devicescisco protocol attackscitrix exploitation attemptcitrix exploitation attemptscitrix securityclosecloud environmentcloud infrastructurecloud infrastructure attackcloud providercloud servicescode executioncolumnscommand & controlcommand and controlcommand executioncommand injectioncommon vulnerabilitiescommunication protocolcommunication securitycompany limitedcompromise attemptcompromised credentialscompromised hostcompromised host detectioncompromised hostscompromised system attemptcompromised systemsconnect scanconpotconpot activityconpot attackconpot attacksconpot exploitationconpot honeypotconpot ics attackconpot interactionscowriecowrie activitycowrie attackcowrie attackscowrie capturecowrie datacowrie emulationcowrie honeypotcowrie honeypot datacowrie interactioncowrie interactionscowrie logscowrie ssh attackcowrie ssh attackscowrie ssh honeypotcredential accesscredential attackcredential attackscredential brute forcecredential brute-forcingcredential compromise attemptcredential guessingcredential harvestingcredential stuffingcredential-attackcredential-bruteforcingcredential-stuffingcredential_accessdata encryptiondata exfiltrationdata exfiltration attemptdata harvesting attemptsdata store exposuredata theftdatabase access attemptdatabase attackdatabase attacksdatabase enumerationdatabase exploitationdatabase exploitation attemptsdatabase intrusion attemptdatabase securitydatabase serversdatabase-serverdcom exploitationddosddos attackddos attacksddos attemptddos preparationddos probeddos probingdecoy systemdefense evasiondenial of servicedenial-of-servicedevice managementdictionary attackdigital oceandigitalocean environmentdionaeadionaea activitydionaea attackdionaea attacksdionaea capturedionaea honeypotdionaea interactionsdionaea malware detectiondionaea malware samplesdionaea payloadsdistributed attacksdnp3dnsdns attackdshield blockelasticpot honeypotelasticsearch monitoringemailencryptionenterprise networkingenterprise securityenumerationet dropethernet/ipeu cyber policieseuropeexploitexploit attemptexploit attemptsexploit kit activityexploit probingexploit scanexploitationexploitation activityexploitation attemptexploitation attemptsexploitation of privilegeexploitation of vulnerabilityexploited hostexternal access attemptsexternal scanexternal scanningexternal threatexternal-scanningexternal_threatfailed login attemptsfattfatt analysisfatt detectionsfatt signaturesfilefinfin port scanfin scanfinlandfirewall detectionfrancefraud voipftpftp attackftp attacksftp brute forceftp brute-forceftp bruteforceftp scanftp_scanfull connect scangeckogermanygithubgroupshackinghelloheralding activityheralding behaviorherolding attackshk abusehandlerhoneynet connecthoneytrap activityhoneytrap datahoneytrap eventshoneytrap exploit attemptshoneytrap honeypothoneytrap interactionshong konghttp attackhttp brute forcehttp probehttp probinghttp scannerhttp scanninghttp/shttp_scanhttpshttps probehttps scanningicmpics securityics/scada attackics/scada attacksics/scada systemsidentity & access exploitationimap attacksimap brute forceinbound scanindicatorindicators of compromiseindustrial control systemsinformation gatheringinfrastructure acquisitionreconnaissanceinfrastructure reconnaissanceinfrastructure scanninginfrastructure targetinginitial accessinitial access activityinitial access vectorinitial_accessinitial_access_attemptinjection activityinjection attacksintel macinternet exposedinternet facinginternet of thingsinternet-facinginternet-facing assetsinternet-facing serviceinternet-wide scaninternet_scaninternet_wide_scanintrusion attemptintrusion detectioniociocsiot attacksiot botnetiot device targetingiot exploit attemptsiot exploitationiot securityiot targetediot/ics attackip-address-iocip-addressesipphoney honeypotipv4ipv4 activityipv4 addressesipv4 attacksipv4 port scanningipv4_addressipv4_indicatorsipv4_scanningjapankhtmlkill-chain exploitationkill-chain reconnaissanceknown malicious iplamplamp attacklamp attackslamp exploitlamp exploit attemptlamp exploit attemptslamp exploitationlamp exploitation attemptslamp server attacklamp server targetinglamp stacklamp stack attacklamp stack attackslamp stack exploitationlamp stack targetinglateral movementlateral movement techniqueslcialinux malwarelinux serverslinux systemslinux targetlinux x8664linux-server-attacklinux-systemlinux_server_attackslisted sourceloginlogin attacklogin attemptlogin attemptslogin failurelogin_attemptlow-riskmail protocol abusemail service attackmailoney activitymailoney attackmailoney email spoofingmailoney eventsmailoney honeypotmailoney interactionsmalaysiamalicious activitymalicious activity detectedmalicious email activitymalicious file transfermalicious ip activitymalicious ip listmalicious ipsmalicious ipv4malicious login attemptsmalicious network activitymalicious payloadmalicious payload attemptsmalicious payload detectionmalicious scanmalicious sftp activitymalicious softwaremalicious software detectionmalicious ssh activitymalicious trafficmalicious-activitymalicious-login-attemptsmalwaremalware analysismalware behaviourmalware capturemalware deliverymalware delivery attemptmalware detectionmalware distributionmalware download attemptsmalware hostingmalware propagationmalware scanningmalware_activitymanualmasscan activitymicrosoft technologiesmirai botnetmobilemobile securitymobile threatmodbusmssqlmssql brute forcemysql brute forcenetworknetwork activitynetwork attacksnetwork discoverynetwork enumerationnetwork exploitationnetwork infrastructurenetwork intrusionnetwork intrusion attemptnetwork intrusion attemptsnetwork intrusion detectionnetwork mappingnetwork port scanningnetwork probenetwork probingnetwork protocolnetwork reconnaissancenetwork scannetwork scanningnetwork scanning activitynetwork securitynetwork service discoverynetwork service exploitationnetwork service scanningnetwork servicesnetwork traffic analysisnetwork-based attack attemptsnetwork-devicenetwork-devicesnetwork-reconnaissancenetwork_activitynetwork_enumerationnetwork_reconnaissancenetwork_scanningnetwork_service_exploitationnmap scan detectednorth americanull port scannull scanoceaniaopen port detectionopen port discoveryopen portsopen proxyopen_port_discoveryopencanaryoperating systemoperating system securityopportunistic attackeropportunistic-attackos credential dumpingos fingerprintingos xosintp0fp0f network fingerprintingp0f os fingerprintingp0f signaturespaloaltonetwors_com-benignpassword attackpassword attackspassword crackingpassword sprayingpassword-guessingperimeter securitypgp signphishingphishing attackphishing trapphp exploitpingping of deathpolandpoor reputationpop3 attackspop3 brute forceportport-scanningportscanpossible botnet activitypossible exploit attemptpossible exploit attemptspossible malware distributionpossible malware dropperpossible malware payloadpossible mirai variantpossible reconnaissancepossible vulnerability probingpotential botnetpotential botnet activitypotential compromisepotential credential theftpotential exploit activitypotential exploit attemptspotential exploit targetingpotential intrusionpotential intrusion attemptpotential malwarepotential malware deliverypotential malware deploymentpotential malware downloadpotential malware hostingpotential malware infectionpotential reconnaissancepotential reconnaissance activitypotential vulnerability assessmentpotential vulnerability probingpotential vulnerability scanprivilege escalationprocess injectionprotoprotocol abuseprotocol exploitationprotocol scanprotocol-abuseproxyproxy protocolpythonransomwareraspberry-pirdprdp attacksrdp scanningrdp_scanreconnaissancereconnaissance activityredis honeypotredishoneypot activityregional securityremote accessremote access attackremote access attemptremote access serviceremote service exploitationremote servicesremote_accessresearchedresource developmentresource hijackingrpcscada/ics attacksscams & fraudscanscannerscanner detectionscanner ipsscannersscanning activityscriptscripting attackssecurity eventsecurity operationssecurity policysensor-taggedsentrypeer activitysentrypeer attacksentrypeer attackssentrypeer botnetsentrypeer detectionsentrypeer eventssentrypeer interactionssentrypeer p2p attackserver exploitationserver securityservice discoveryservice enumerationservice probingservice scanservice scanningservice_enumerationsftpsftp access attemptsftp access attemptssftp activitysftp attacksftp attackssftp attemptsftp attemptssftp bruteforcesftp exploit attemptsftp exploitationsftp probingsftp scanningsftp-attackshell upload attemptsip attackssip brute forcesip heraldingsip probingsip scansip scanningsip vulnerability scanslugsmb attackssmb brute forcesmtpsmtp attacksmtp attackssmtp brute forcesmtp probingsmtp scansmtp scanningsocial engineeringsoftware exploitationspamsql injectionsql injection attemptsql injection attemptssshssh attackssh attacksssh brute-forcessh bruteforcessh monitoringssh-brute-forcessh_scanstealth scansurface websuricata alertsuricata alertssynsyn port scansyn scant-pott1005t1016t1016.001t1018t1020t1021t1021.001t1021.002t1021.003t1021.004t1021.005t1021.006t1027t1040t1041t1046t1047t1048t1048.003t1053t1053.005t1055t1056t1056.001t1056.004t1057t1059t1059.001t1059.003t1059.004t1059.005t1059.007t1064t1065t1068t1069.001t1071t1071.001t1076t1077t1078t1078.001t1078.002t1078.003t1078.004t1083t1087t1088t1105t1110t1110.001t1110.002t1110.003t1110.004t1133t1134t1187t1189t1190t1195t1195.002t1199t1203t1204t1204.001t1204.002t1205t1210t1213t1486t1496t1497t1499.001t1499.002t1499.003t1505.002t1505.004t1539t1555t1555.003t1559t1562t1563t1565t1566t1566.001t1566.002t1566.003t1566.004t1572t1573t1573.001t1583t1583.001t1583.002t1583.003t1584t1584.001t1584.002t1584.003t1584.004t1587.001t1588t1588.004t1589t1589.002t1590t1590.001t1590.003t1590.004t1590.006t1592t1592.002t1592.004t1595t1595.001t1595.002t1595.003tannertanner activitytanner attacktanner attackstanner eventstanner interactionstanner web attacktargeting databasetcp protocoltcp scantcp scanningtcp-scanningtcp/23tcp/3306tcp/80tcp_scantelecommunicationstelnet attackstelnet attemptstelnet threattelnet-brute-forcethreat actorthreat detectionthreat intelligencethreat intelligence feedthreat preventionthreat_actor_unknowntimeouttokyotor nodetorontotpottpotceubuntuudp port scanudp scanudp-scanningudp_scanunauthorized accessunauthorized access attemptunauthorized access attemptsunauthorized activityunauthorized loginunauthorized login attemptsunauthorized probingunauthorized scanningunauthorized-access-attemptunited kingdomunited statesunited states of americaunknown threat actorunsolicited emailunsolicited network probeunusual network trafficusus ip addressus noneuser enumerationvalid accountsverified-benignvnc protocolvoipvoip attackvoip attacksvoip systemsvulnerabilityvulnerability scanvulnerability-scanningvultrvultr parisweak credentialswebweb app attackweb application attackweb application attacksweb application probingweb application scanningweb attackweb attacksweb crawling detectionweb exploit attemptsweb exploitationweb exploitsweb scannerweb server attackweb server attacksweb serversweb service attacksweb shellweb shell attemptweb shell detectionweb shell uploadweb shell uploadsweb spamweb trafficweb-application-attackweb-serverweb-serversweb_attackwindows ntwordpress attackxmasxmas port scanxmas scan

Activity Timeline

1 total obs

Jun 17Jun 17

Threat Activity Heatmap

· Peak: 2026-06-17

Less

Mon

Wed

Fri

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Apr

May

Jun

24h

Dormant

30d

Minimal

3mo

Minimal

Threat ScoreMedium Risk

SIGNAL

Signal Score

66%

Confidence

Reports

First seenAug 20, 2022

Last seenJun 17, 2026

GeolocationUS

CountryUnited States

LocationSanta Clara, California

ASNAS396982

OrgPalo Alto Networks, Inc

Coords37.3835, -121.9830

Proxy

VirusTotal

Not checked

WHOIS

description: IPv4 hosts detected port scanning Vultr Tokyo (Japan) honeypot
raw: NetRange: 205.210.31.0 - 205.210.31.255 CIDR: 205.210.31.0/24 NetName: PAN-22 NetHandle: NET-205-210-31-0-1 Parent: NET205 (NET-205-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Palo Alto Networks, Inc (PAN-22) RegDate: 2022-01-11 Updated: 2022-01-11 Ref: https://rdap.arin.net/registry/ip/205.210.31.0 OrgName: Palo Alto Networks, Inc OrgId: PAN-22 Address: Palo Alto Networks Address: 3000 Tannery Way Address: Santa Clara, CA 95054 City: Santa Clara StateProv: CA PostalCode: 95054 Country: US RegDate: 2017-11-22 Updated: 2024-11-25 Ref: https://rdap.arin.net/registry/entity/PAN-22 OrgTechHandle: GNS20-ARIN OrgTechName: Global Network Services OrgTechPhone: +1-408-753-4000 OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/GNS20-ARIN OrgAbuseHandle: IPABU42-ARIN OrgAbuseName: IP Abuse OrgAbusePhone: +1-408-753-4000 OrgAbuseEmail: [email protected] OrgAbuseRef: https://rdap.arin.net/registry/entity/IPABU42-ARIN

`205.210.31.45`

MITRE ATT&CK TTPs

Network Information

IP Category

Feed Intelligence Summary

Activity Timeline

Threat Activity Heatmap

VirusTotal

WHOIS

Export & API

IOC Journey